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(57)Abstract 

PROBLEM TO BE SOLVED: To limit the transmission band of 
offensive traffic for a distributed denial of service (DDoS) attack 
while securing communication traffic for regular users. 
SOLUTION: When the suspicious offensive packet of the DDoS 
attack is detected, a gate device 2001 transmits the suspicious 
signature and the regular condition of the suspicious offensive 
packet to upstream communication devices 2002 and 2003. Each of 
the communication devices 2002 and 2003 cancels the transmission 
band limitation of the packet identified from the regular condition 
and a regular signature created based upon the suspicious signature 
while limiting the transmission band of the packet identified from the 
suspicious signature. Further, each of the communication devices 
2003 and 2003 transmits the suspicious signature and the regular 
condition to further upstream communication devices to report the 
suspicious signature and the regular condition to the upper- most 
stream communication device in the recursive manner and each 
communication device further limits the band by detecting the 
offensive packet from the suspicious offensive packets while 
implementing the band limitation of the suspicious offensive packet. 
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tW^#fS] y- h «S 2 0 0 1 (1, D D o S lj(!^<0 
JcSfSSg^/^-y-y h«r*jltB-rst> ±j5itOjlfi^S 2 0 0 
2. 2 0 0 3fCl!?^^^/^y-y hOD^^->^*^-V fclE 
M^ff^iMMf So ilff 2002. 2003 {*, ^ 

l^-r-So ijEfi^^2 0 0 2. 2 0 0 3l,i.-S<biC±m.(Om 

mmm^mm l * *^ e. , txmm^/^^ -y h a- e> ist^/ ^ 




• > .1 1 



vt-y ^'^^fiK-rs-'^y-y h(03l^m7c^--y hV-^^lt 
^UT, U^H3iejMtiJ7C^--y h7-i'*^e.)liai^n*3ESl 

•y h<DBmwmum^mf^.t^mm^m\ 

mk. iEMi'^^^A'K:J:oTS8giJ*n.5IE^i/^y>y h 



(2) ItF^I 2003-283 554 

2 

Xtl-^n^mm/^^-y h^^:L-yi'L. msE^^^-yhm 
BuflB h ^ t -y i^Sg^^etc J; t?T«IIH^nfcmfHBiSC^S 

t-yiJ'^titBb, 

>v hy-^'A^p.jMm^nsifcii/^^-y hcoeiMwuit^^ 

20 Slc*iJPg-rsc:i:*it#84i:-rsit*3S5tclBiEoy-h 
[SSaRJS 7 ] ms,' ^-Jr -y h ^tB^f^lBIt sua s ^ 6 
-^•y hT'feS^ff^5^-riEM*{f%tBtiL. 

JO ButB->^*5^^jM«¥efi> 8ufaiE*i^fr*BulB±S!t<0 

T8aoy-h^BS'5VHi3aifS^BA^P.SM->^^^+ 

^Sfi t- s i/ y 9=- + i: , 

-^0 H5fBS^>'^^^^^-\' «:±8S[©jl{i«B»Cj3l^-r S i^^^^^ 

^ft"S^ S c i: -r ^ iffifi^Bo 

ntJRa 9 ] X:^*nsa{|fBlj?SSg!g/^^r >y KD f ^ 
t -y^^^mLX^^ b 7 1 <y ^'J&ltfflr-S n -y 

BiJIB^^y^^lSti. HuiaiASS h 7 1 -y d'^^tfig-T 
y-y h02im7C^«y hy-^'«-#^LT. Siff32Slli7c;^ 
•y h'7-<?*^P,illtil«n5i5(l8/^y-y hOf5j||^i@i^? 

P. tcfiiijK-r 5 c t tr^nmm s fcsa^iEojinfi^ 

50 s. 
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3 

* nity- h siH±T-*fir* 3 > ^ - ^ ^ 
)M^J|S%$iM-rsX7" -y yii, 

mmm^mm-r s x x -y y , 

iMfl-rsx-r-yyi:, 

fJ^?!tS^S''^'>--y hOh^t-yi}'«r»«fLr?Sl«l-^ 30 
n -y ^>;&1^tar-5Xx-y yi:, 
iJuiaijSc^ h k -y ^^^"r-vh OiUffiTC^^ -y h 

V-i'^lf^U StilEiMHiTt^^-y hy-^ft^e.3aim*n 
5?feS/iy«y Koeitimi?ll«:5afcMBB-r«.;^f--yy 

A N h b nfc * -y h y - 

m^^iEm^i^ t mmm > ^f^-^^t ^micmm^^'ir >y 
jEMi^ ^^-^^vm^it n^jEM^i^ -y h (D&mmmM 
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jMffrsXx-yyi:. 

mm^m^m^^'r -y h o h ^ t -y ^^^«t lx^x^ h ^ 

t -y f^^ttii-rsXT^yyi:, 

H>lt2i5c^h7li-y^*1gfi5cf S/^-^-'y KD5MJ±J?c^-.-y h 
5]5S8''^'5^-y hOg)li?r1t|?:gr*&»clIiiJ|5g-rsXT->yy 

LAN i:OP^fc^>}f ^nfcy- h^M±T'llfT^ n^n 
> e J. - ^ :/n if ^ A «:ge^ L 3 V If n - ^» gsaiK 0 

A;'3 SnSiiM h V t -y *^5^46j3ii6 e.nfc iScIS^^^ ^ 
-ir-y KD^lil*fi|=fC-&grrSA^5A^^^x-y'>-rSXT- 

•y^i:. 

^S(U/ch7i:-y^^<^mbrc^^tc, i^ffi^nfcMsa 
ijt^^M-' ^-^^ -y h ^sag'j-r s §ij y ^ + ^^fig-r 

XT^y^i:. 

-y H ^laSiJ-r -5. lE^ii' if ^ + ^^fiict- S X X -y 
iM^HS^rStJIS-r 5 X 7" -y y i: , 

mteiE^i'if:*-^^ T'laSBU* tiSIE^S/^ir -y h ©giMfif 

i|liSiJ|5g%S¥^-r S X X -y y i: . 

Sfl-rsXy^yyi:. 

k -y i' 5 X -r -y y , 
lj(/»a?!i!8Sf-^ii-yi'^fi?fi!c-r^>'^ir-y h«jMad7n^--y h 

S^StiS/^ir-y hoeSl^ig** e.fcSiJ(g^SX7^-y y 

o^jasB^: 3 > tr i - ^» tc^if * -arsij-iJisiJ-y— ex^ 

HEiS^KBSity n if 5 A ^legi-r « c i: -r 5fBS 

A NA^y- h«H*/|-LTj$»!*n/-c^^<y h y-i'^W 

fig-r 5ii<i^a±T'*fTS ti5 3 >' If 3. - y a if -7 i» 

i: lE^I^fr i: ^Sfif ^ X -r -y y . 

jM^^^M^-rsxT^-yyt, 

MiaiE^I^f')^ i: HufBSI? if i: ^StclEffl/^ir -y 

h ^lasij-r 5 iE*i if ^ ^ ^fig L , bGibie*! -> 
xmm^ n^iE«?/^ir -y h cogi2iviJ®(iiiijpg^«i^-r 

^Xv^yyf:/ 
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O^jaa^ n > ;l - ^ ^fT ^ -tt ^ ^i^ii^-y— tf x:^ 

[0 0 0 1] 

s M ^ e Die ^ <D n > ^ - u y ^ ga r s o 

[000 2] 

[ije^KOSifi] SeJK. TCP/ I P (Transmission con 26? 
trol protocol/Internet protocol) ^ ^co^- ^y h "7— 

■r^-tf— ex^H^ifc^ a:^T. ro o S (Oenialof Ser 

vice) liL^j ^gar) ^R6<*c^ti%j^^nrv^^i^o 

TdDo S (Distributed Denial of Service) ij^^J 

jci^t-^l»Wc>:^}£ti*fc^mw^:6-ffiA^P^ft^nTv^ 

[0 0 0 3] CODD o SIjiCS?tcW-r^KS|Jc075'ai:L 
Tti. v'Xnti^^^Jl^L/c Ingress F i 1 t e 
r (RFC 2 2 6 7) U U N E T?±fO C e n t e r 
Track:6'^fe^o tO#ei. D D o S lif^OggtcH < 

t^n^jMfi^T K U'xcogm^^x -y ^-r^mmv^ 

— ;^7;l/jLU7'^^*y h7--^:0^&'Y>'^-~^-'y htClRlA^o 
^y^L. u-;^;bxUZ^^*y h7-^tCfiJt)ST^n/c 

[0 0 0 4] ^/c. DD o S%km^mmLrcy-VJ:K> 
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6 

mv—\f::^^m^km<Dm±y5m mmz 001-274 

0 I 6) > AT&T?±iSiS: (R.Mahajan, S.M.Bellovln. 

S. Floyd, J. loannidis, V. Paxson and S. Shenker: "Co 
ntroliing high bandwidth aggregates in the network 

- extended version" (2001)) , I D I P (Intruder 
Detection and isolation Protocol) (D. Schnackenber 
g, K.Djahandari and D.Sterne: "Infrastructure for 

intrusion detection and response" , Proceedings o 
f the DARPA Information Survivability Conference a 
nd Exposition(DISCEX), South Carol ina (2000)) ^if 

[0 0 0 5] 

i^mmmL^vtr^mMi ±^Lrc Ingres 

s Filter (RFC2267)ti. jMfi7t:T F U 
X^fpfi-^LTDD o SljC^i^-r-SC^^^^it'TS/ca^'D 
aaSTfeO. i5f^^§ttS(Pi|A^I»®l-r^/'c46ti:<^aSffi 
THi^l/^o ^/c. Center Track ti:. ijClS^ 

[0006] ^^til. ±aiL/c: Ingress F i 1 
eter (RFC2267)tix TELl^ I P (internet 

protocol) 7 Fl^X:6SMft7E:^i:^oTV^^ I P/^^-y 
F <fc S JjfSStc ^ o /c < ^ja ^ ^ U \ ikmTtirC tj: o 
Ti.^^n-;^;V3i';T^>'y hV-^ ir-TV^-^-^^y ht 
(DiM.^X&^^U^'^iC Ingress Filter*^ 

=&l^^l/>-9iaijii^.3()^fe^o ^ fc. ±aiL/cC e n t e r 

T r a c kti. ^M^mmic^WL-^nrc^miD o sco 

Ijfc ISjc :^ T V ^ ;5 n V tr — ^ ^ ^ CD 3 > tf It — 

g^rc^nru^^^-^^y Fy-^owini^tciiiijs^L^i/^ 
[0 0 0 7] ^fc. c:tDmga^Di5ifgB^#ii;^)^mgMrs^<^ 

X^t|x3c»oiS5±>3}£^A T& T^XT* 
ti. I P/^^^r^y F^T^T-— ^:7^— ;l/F-^/^^'y F<7)^^ 
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^ss©i»jLt75)4. A T & irnxms i d i p tcfertt, 
[0 0 0 8] imm^t. ±iB*if*%£tLT^^n)rct. 

T?-ti-SlS^^liML^A^P>±i55iy-KT'DDo SlSt^ 
[0 0 0 9] 

fBL AN*5<fct>*^^-y V'7—'P(r>mnfKm^^V:.V—Ym 

J; -p rafKBij^ n^ijfi^siJ/ ^-5^ -y h (Di£:m'^w.^umt 

[0 0 10] Bl93c3H2tcKi|K(056HJ3(±. SiSsR^^ i tcoBililc 

StiSijflSiSliv'^y-y h<Dh-7l:-yi/;&^^^ffLTiA^h 
^li>y^'J&«iaiU. mlfBJ^»b^n-y^'^«ifi)cTS>'^^r 
•y KOjMHiTt^-y hy-^^#^UT. J-XttstlBiMtBTt 

[0 0 1 1] IfsJtJSStclBitOfgBgli. lisR]^! S/cJi 
oT, aijlBy-h^B«. iEM*'Jffl#04S*^B*^e.(D 
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^fc^tc, BufBiE*I^#fcHufBS^->^^^^^ i:^»tc 
tg, ftOgBiE^->i''*f^-vti:j;^TSaS'J«n5iEM>'^'!r-y 

[0 0 12] 4 JCiB«cO^Ra«. I»^ISl~fi* 

10 m 3 ©v^-rn*^o«tcgBiffifiDiJ>ias-9-- \L-x^wmm 

±;5^T'^oT. Ti'-r-<:f;toy h'7-i5'±T'i!l{tf a 

[0 0 13] l§5R^5»c^i|iE058Wtt. «S(05ffifgSB 

any tr3.-^*5j;t/L A N tcDP^tc/l-Jf ^n/ty- h 

•y h(D^tbl^{t^l31«.-ra/'?y-y MtHl^frlB^gP t . 
A^^J^n^iifl/^-y-y h^^x-y^L. h3IB/ ^-^r -y h 

m^mmm^-^^mt a sstssssi'/ -y h (omm^i^^ 
^mt. m?,v^\^"j ^m.n^mni.-Dxm.\^-^^rzm 

uinLxmis-r?>i^ir^-=f-^mm^mt. ^m^^ct 
[0 0 14] tmm6icmmo:>^mii. m^rMsictm 
30 ti^!n^m^^mmm^'i^^yh(Dh7\i'y^^^mi.x 

Ph^t:-y^'*tfM-r5>'^'>--y b (OmOiTb^-y hU-i^ 

So 

[0 0 15] B»A)<i;i7iciBiIiE056H;jtt, M*9i5*fct± 
i^immmi3'^<omm^^^ -y h X'$>^^f¥^B-rmm^w 

->y^-.^^T-^gij*naiEM/^y>y h(DBmmmum^ 

m±m<r)msmmictiLxmmt^ct^¥fWifr^. 
[0 0 16] giAR3*8{cfB«EofS0^tt. wmtimx&^ 

so t^-y^^-^^sm^mt. MiBS^-v^^^^-vpiasij 



p 

^ a t , mria^n v- y * A- ^±atoiifi^stc jit^-r 
[0 0 17] m^^9icim(D^mii.. m^msic$m 

[0 0 18] m^mi oicmmnnma. nmmsi^tc 
[0 0 19] iisRJSi ncim(Dmmt,i. im<ommm 

feS rj > tf zi *5 J; L A N i: OP^ir^>Jf ^ n/ciy- 

h ^M±T-jitT5 ns n V tr i - ^» :/ D ^ V AT-* -3 

ffi ^ n/ciiuneiASs^M^ ^-b- -y h ^niSB'j-r s ^Mv' <>*^>^ 
IS§li->'^^^^^+ lEM^^^ -y h ^m^fit^mm'> 

i: HuffBIE^I^f^^igitOjiSfiSiltiMfl-rsXv^ -y 

»h9t>yi'^<^ta-rsxx-yyi;, HulHiic^ h ^ t -y 

^^ft'M-r5>'<y-y h©)Mtb7C^^-y 

fufeaitarc^^-y l-y-i^!b^e,jMtt*nSi!?l8/^^-y h<D 

giM^lDc^^?.lc$iJPg-r5X-r-yyi:. ^n>t!.i-:5? 

[0 0 2 0] If*^ 1 ZtClB^cDPgB^ti. RS'OJ^^T'S 

■rSX-r -y n(iS2g|J>'<74^5^^T',1($5]"J*n2.i$t!8? 
^^-'^^•y KoeJM^lHii&SiJPS-rsx-r-yyi:. MfSIE 
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m^i'^tmE^mi^'^^-^^'t^miciEm^^'r'y h^wi 
>'^'5r.y h<Dh^\^'y'>^^mi.r^mh3\i'y^^mm 

t^XT-y-Tii^ mnliX^h^\i-y'>^m&-r^^^'r-y 
hOi^W7T;^^-y h^-^'^ilt^L, MI3iMtB7C^--y 

-■^t^^mm^ti^^xm^^^'y h(o&m^)^^-^^icm 

So 

[002 1] 1 3 tcieii£o5gBj5{i. m.$SL<ommm 

B^^at>ctig^LT=S:S^^-y hV-^-i:, l?S^W^T' 

h ^il±-e*tf * =1 > tr a - 3* :/a rj'"^ A^iHfii L 

^nsilfih^fc-yi' iJ^^^^^ e. n/-ci!i«^S/ <y -y 
h£D:^m^mc^gfrSA^S*>^^x -y ^'f-SXT^ y 

^*fefiK-r5X7"-y ri:, B3i2g^i>^^^^^-v -pias'j^n 

^■SCm^W^'r-y KDeiM^^^WBg-rsx-x-yT'i:. 

^$'M^fi?l^-rsX-r-y:/i:, Ht(l2^^->y^^g^^ tSu 
teiEJi^{*f^±}Sit(Dafi^Sli:iM{I-rsX-5">y bG 
rBiAI^^IJ^ <y -y h © h V h -y ^«-«t bTijt!P h ^ t: 

TC^-'y h7-^'*^6.aMtilSnsiASS>'^y-y V<D^mwm. 
«:*?.fcSiM-r«X-r<yyi:. O^iajl^rrj vtr^-^f 

{cgiiT^-ti:s»ii(§y-9— trx^i^tgifeigte^r/Dy^A^- 
[0 0 2 2] m-mm 1 4 tciBS<o5iiB)3{i. mmn^X'h 

f X -r -y y t , mff B$^ -> i^^?- ^ + T'lSISU * S iStIS 
^^/^'^-•y hoeiM?iJl|lt*fliiM-rsX7">yyi:, fjfjflBIE 
^S^{'t=i:HufBS^i'^^^5^^i:*»tciE^/<'5^-y 

I'issij:^ nsiE3i/^y -y H <DeJli^i^^l^^rilJ|5s^^^lf;■r ^ x5^ 

■y yi:, MIB$^->^''^^^-v i:HutBiE*I^ff*±}5!tOffi 
©SEH»i:^©-rsX7^«y^i:, mi^imW^'ryVco 
h 9 H -y ^ L TiStIS h ^ t -y ^<^ffi-r 5 X -r -y 

yi:. iiunBljJPh^t-y^;S:«§Bg-rS/-?y-y hoaJlttSn: 
50 ^-."jW-^ S-lt^ L, SJiaJMltiTn^ «y h "7- ^ e. jH 
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[0 0 2 3] 

T> 2 0 0 Oti1t— 2 0 0 Ui<l(O|gB^C0— ^jSSJB 

^s^c<^:sy-hSll (y-h'^^x-Y) . 2002-20 w 

2007 — 2010 iti^^mmX^$>^o D D o S 
?SfSi<0M?fcS?«'O-9--/^ 2 0 0 0 A^iR^^nTU^S L A 
N (n-;^7;l/:nijy^.'y (i. >5^^-hSM2 0 

0 1 tcJ;oTi'1^gP<D;^^*y h y-^tcjgj^^ nT(/^§o ^ 
LT. h*?— ^«ailfiigli2 0 0 2. 2 00 3. 2 
0 0 4. 2 0 0 5. 2 0 0 6^WLTV^^o D D o S IjC 
lg^tC.t:oT#.f^;?n/cfiS*^H2 0 0 7. 2 0 08. 
2 0 0 9;^^ IjcS?/^y^V h^?Sft^#01f— /^2 0 0 0 

2 0 0 1 0«ig^}'gSLTL^V\ DDoSIJCl|l#^fi 
«lfflf^^jE«i?U;?1#<Ofiffl*2 0 1 Oti^^^-/^2 0 0 0 

[0 0 2 4] ^—Y^^mz 0 0 Ui. ^^6-9— >'^2 0 0 

— h^ll2 0 0 Ui. BSffliJ^fgiO-y— /^2 0 0 o&t/-9- 

— /^2 0 0 OA^iR^^tlTl/^SL AN<Om^^tCj:oT 30 

[0 0 2 5] mz\iC^^^^-^mnm.^\^^mt. 

h^<^mT^/ci6ti:^ffl^n. 3fflOlx:3-K<^rtf7)v^ 

C(r)h^t:^y^(7)iiSfi/^y^y htiij^S^^IJ^^y ^y FT^ 
^^SSS^tlSo I P/^>>-^y Ft7)S3/4 -^0 

ttTfe^ I P(0 roestination IP Address \ PT 

i/^T. #^ I Obn— FOl^m^ttti. roestination 
IP Address it\l9cl PTFUX) J ri92. 168. 1. 1/3 

2j (dst=i92. 168. 1.1/32) . I p<o±mm dm 

4S) cDT^n Fr3;l/agij;^^f TProtocol (ynFin 

J TTCPJ XS>*D (Protocol=TCP) . t^-D. m 
4 n F ifozr U '^r-i/ 3 >cDti9^SA^^^^*r 
roestination Port (^Jfesi^— F##) J rs OJ T* 50 
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/2 

{Port=80) ^v>9Stt^^Ut^neSttficO)SST 
Ji^^n^So #^2cOl^r3-F1#.m«ttti. roestinat 
ion IP Address I PT FUX) J ri92. 168.1. 

2/32J X^K> (dst=192. 168.1.2/32) . ^^O. TProtoc 
ol (:/nF:3;W J ruDP (User Datagram protoc 
ol) J (Protocol=UOP) ^(/^^JlttffliJJ'J^^^n^ 

mmmmx^^-^n^o ^rc. s^soun-F^^tti 

Mtttis roestination IP Address I PT^FU 

X) J ff^ ri92. 168. 1,0/24 J T'^^iS14aSiJi:^Ojl14 
filHTJg^^n^o «SteB8fflti:. li^jUUn-FT-Jg/g^n 
^1^tBStt^ifo§{i/^y^y FOF^Vi^y^;^i3j^^^ 
F^l^^y^hLT^^tti-r^/c46cD«fgtOfEM^«^. tk 

10 0 2 6^ m 3 icmf^mm^mt. ip/^^yFo 
^3/4 jifiiiiaB'j ^ ^m^mcomt^ b ^ ^ 

^C:te^/^T. S-^lOUn-FO^ttt5S14tis I p^o rso 
urce IP Address CMiSTXil PTFUX) J ±1^ ri72. 16. 
10.0/24J X&^Ct^m^L (src=172.16.10.0/2 
4) . S^2tDUn-FO<^ffiS14{± I P±iD^t-ex 
iSiM^^t* TType of Service (l^-^f Xt5?-f y) J 

r 0 1 (^^-9-) J xh^ c t^m^i^xi^^ (Tos=ox 
01) o coiE^i^f^tcti. m^is. v-^'^mmm(om± 

0^0^. [Mjiiji^tt^i:. R5ffll*f«iO-»t-/^2 0 0 OR 
t/-9--/^2 0 0 0;!)^iR^^tiTV>^L AN<DmW#3b^jE 
f ^ ^ ^ iSi^ L T v ^ ^ ^y F ^7 - ^ to MimTt I 
PT' FUX:^^:6^^:£^n^o 

[0 0 2 7] ^fc. y-FSS2 0 0 i:5^D*ilfiSS2 
0 0 2~2 0 0 6ti. Ij?:^^i^/^>y'y FOF^b^y 

^mm^i^^mnT^o m 4 tc^iEF ^^^^ ^mm^n- 
(om^com^^s^o ccxit. #-^tii^3-F^#^t- 

ftlOD D o S l3?^0?aS(CD F 5 11 -y ^/^^-^^b^BtiVM 

ti. rejMi^inST 1 K b p s &.±(o^^^-y F*^ s 1 

LTi/^^o ^/c. ^5t2CD:T^iEF'^ti'y ^^f4^«> rg 

3M^^T2KbpsJ-;^±> msmf^hzijvxh^i c 

MP (Internet Control Message Protocol) ±(Dolzi 
— IS^ (Echo Reply) ^ •y-fe— v^O/^-^r^y F/)^S 2g.^t:>( 

±mmm{strix\^^^j F-^ti-y^^-^^-v^^ 
LTv^iSo #^3o^iEF'^t:^y^^mi. 
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[0 0 2 8] ccr\ y-h^g2 00 i&t/jffifi^B 

2002-200 6/)^fii;^^^ftlSSiJfflJtf'>^l/^ltt0^'r 
12 5 ti:**fifi<omitc*5^tsy- hS«2 0 0 1 
t>*3lfi^S2 0 0 2 — 2 0 0 eti^m^^^^^MM'ey^^u 

nmt^rci5b(D'e'f;u^^To 2 0 2 a 

:tr^nfc/^>^^y h^iE*I^'^X2 0 2 2. §^^-7X2 
0 2 6. ^IE<^7^X2 0 2 4(0 3 00^^Xtc5i^®-r 

mmt^o iE«l^^X2 0 2 2^*7=^:7 71/ h^^XTfe 

n - 2 0 2 3 tCO:&;b^n. e^ll^il?^ Wt/ ^ 

n^o S®^^x2 0 2 etc^j-i^i^n/c/^y^y hti. m 
mnmo:>V"-/'^2o o orz^v—^^z o o otm^-^n 20 
ri^^^L Ai^mc^^'t^^m^:x—2 0 2 iic-^^t'^ 
n> i^^iaw^^o+f— /^2 0 0 o^t/-9— /^2 0 0 oj^j^iR 

0 O^lRgLTl/^^^'- hSH2 0 0 1 <DUm^^-(D 

BmmMmim±mmnm(ov—/'^2 0 0 oRtf-9— 

200 0:^)^i|X^^nTV^^L ANOmW^t^<=toT^i6 

11 2002-200 6T(i> Ti5fiC);l/-"i5?:6^P,g{SL/c 

^^c-:)^.^T^i^^^zE■r^o ^iE^'5X2 0 2 4^c5^m^n 
/c7^^»y hfi. T-iE^o.-2 0 2 SifC'D^t'^n. "t^-/^ 

[0 0 2 9] mi^x. y-h^M2 0 0 ijSLummi&m 
2002-200 6*ME3Mmm^jRB^^?T-r^:rc46cD. 
:7^;i/^ 2 0 2 1 (o^mTjid^vxL.ic-ox.^rmmt 
'!r-hss2 0 0 1 Rtfmmmmz 0 0 2-2 0 0 

[0 0 3 0] ll6(i7^7U^2 0 2 1 tc^nt^i3^^iT;u 
nUXA^^To X-r^y^S 3 0 0 1 tC^oU^T. 

:7-<;l/^ 2 0 2 Hi. A:^)^n/c:/^y*y Vtl^JEmi^^f^- 

tlg^tCti. /1>>-'y htiIESI^'^X2 0 2 2tC5i'S1^n^ 

(Xx^y^'S 3 0 0 2) o iic:T% lE^i^y^^^-^te:^ 
g(L^7()>-:5rc±l'&tiX-r>yrs 3 0 0 3tC31^. /^^^'y 

^^{C^mLfcm^. /^^*y hti^IE<>^X2 0 2 4tc 
5^iB;^n^ (XT^^yT'S 3 0 0 4) o ^IE->^>^^-V 50 
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^SjL^S:;b^o/c^^tiX-r^yys 3 0 0 Stcil^. /^-^r 

tC^a-rntfS^^'7X2 0 2 6-\»S^n (Xx^y >^ 
S 30 0 6) . SMv-^^t^^^^tc^SL^^t^. -r^t^-^ 
to -^^ JC^SSf b >«^tC tilE*^ ^ ^ X 2 0 

2 2^5i'S^ns (X-r^y^S 3 0 0 7) o C(DJ:-9^c 
LT^^^Xtc^?|^n/c/^>5r^y iEM^ii-Tfe 

[003 1] m 7 hsfi 2 0 0 1 mimn 

ii{i^M2 0 0 2. 2 0 0 3(D>'y;t'^^^§{i0$^OKl{'^ 
^^sTyti-^^—hRZfm9(D^—hmm2 0 0 1 R 
t/iifi^^2 0 0 2-2 0 0 eco^iEh-^ti^y ^^^ffiBt 

[0 0 3 2] |^70X-r*yyS 3 0 11 JCifeV^T. 

h^B2 0 0 ui. ^m^^^m^i^ (iKf 2) tiiyeo 

1^m«tttc^i5j-r^ h^ti^y^^^x^y^^^L. 3M 
CD U n - F O O V ^rn*^ CO U 13 — K B^S( L /ciSa-. 
C O h ^ H ^y ^^ife^SM h ^ «i *y ^ ^ bT<^m*r 
■r^^s Xx^y^S 3 0 1 2tC*5V^T. d^Dl^W^n/c 

lill^® h ti ^y ^:^)^rS/c \^r\^^^Jkm^m^i^^i^o:> 
som^m^mi^rmmr^t. igi2tc4ott^s^ito 

Un-K(7)^f^|^T'^tH:5^n^>'^^^y h^O^^i^^'^^^-v 
(i{dst=192. 168. 1.1/32, Protocol=TCP, Port=80} J^: 
t). 0 3 J:0IE*Ii/^*:^'^^-v(i{src=172.16.10.24, dst 
=192.168.1.1/32, Protocol=TCP, Port=80}S:t;{T0S=0x 
01, dst=192. 168. 1.1/32, Protocol=TCP. Port=80}i:^ 

So 

[0 0 3 3] :k^^7:\ Xx^y ys 3 0 1 3 tC*5V^T. 

-h^iS2 0 0 Ui. xx'y:/s 3 0 1 2ti:i5V>T*fiJc; 

2 0 0 o;^t;if— >'^2 0 0 otmB-^nr^^^ l an^d 
m^mm-r^fcisbo^mm^^- 2 0 2 i^^^-r^o 
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0 2 1 CD^^SZ^bdrUXAtcSfoT. S^i/^^^^-VtC 

[0 0 3 4] ^LT. ^-hmm2 0 0 Ui. X-r^y^ 
S 3 0 1 4 ^mnr^o r^t>t>. h^M2 O O 1 

mMm^h^imomm^m 002. 2003 w-^m 
^wmmt. m7L\^.. v-vmm 0 0 1 mm:t^ 

Co 0 3 5] M^^^ ^m^^^^^f-^. XE^^ffSt/lAS 
^M/^^^y hco^^$iMfe(0^{t«F03lfi^g2 0 0 
2. 2 0 0 3<:O®j{^;g:?Ji0J3T'5o lll8 0X-r^y:/S 3 0 
2 1 JC*5V^T. afi^S 2002. 2003 ti. V— V 
^H2 0 0 1 :0^jMftLfc (X-r-y^S 3 0 14) g:^^^ 

firSo r^i:. X7^'y:/S 3 0 2 2tC:f3V>T. iffiflS 
S2 0 0 2, 2 0 0 3{i:. §fiL/c^^>^^'-t^^^i:iE 
^l^f*^StClEJI>'y^>^-V^^^-r^o 'r^t>^. IE 

^IE^i->^^t^^-V^LT^fi5c;-r^o X7"^yyS3 
0 2 3 {cm^. imfl^il 2002. 2003 ti. §fg L 

^2 0 2 1 tcSiiL. ^!l5>'^*:t>^^SmiC^^^/^^ 

-2 0 2 7^^^-rso cntcjco. 0 5 tc^-r^MSU 

T. X-r^y^S 3 0 2 4fi:;fc(/^T. ilfi^M2 0 0 2(i 
^o±i5facfe;5jiBM^il 2 0 0 4 tc. mmWM 2 0 0 3 

ti^<D±SitJC$>^il<i^®2 0 0 5Rtf 2 0 0 6 tCSff 

fi-r So c c -eiscis^^^ -y h (oB^m^mmmmt. 
m^ii. mmmmz 002. 2003 t'^^mL.rcBM^ 

Co 0 3 6] ^LT. Mfi^S2 0 0 4 — 2 0 0 Gti. 

iifi^B2 0 0 2. 2 0 0 33b^^^^>-^':t>^^^IE^ 

3lfi^B2 0 0 2. 2 0 0 3JC4bntSX7"*y:/S 3 0 2 
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1 — s 3 0 2 3 ^ nm^^M'^-^^o 

CO 0 3 7] v-vmmz 0 0 iB:t;ji{igB2 

002 — 2006 (D^JE h fci ^y ^«ltti0*Oi!lf^^nttBJ3 
r^o ^9 0X-7"^yyS 3 0 3 1 te::|oV^T> h^H 
2 0 0 1 Si;ilfiSM2 00 2 — 2006 ti. DDoS 

10 0 0 2 — 2 0 06ti. XT^-y^S 3 0 3 2tC:}3l.^T. C 

<7D^ad^n/c^iEh^H-y ^^ft (^4) ^?K/c'r>'^':r 
-y hOi^^lTCl PyKUX^^r^^IETFUX^H^LTitf 
^L. CCO:^IETKl^X!IiBlfflT*t). g^S/^:^ 

LTy— h^B2 0 0 1 BLtfffl{iSB2 0 0 2 — 2 0 0 
6ti. X7^'y::^S 3 0 3 3Ji:43l/>TC:c0^jE>'^"'^>^^-v 

^7 ^;i/i5? 2 0 2 nc^@-r So cnicj;Os las^c^ 

•r«S*Jffli^rx;i'^lgI6tc^-r:7^;l/^2 0 2 1 (D'^m 

20 «/^y*y hoeai^i§ScJi^?)tcwi^nso 

[0 0 3 8] J-::^±l5i0^L/ci!iftti. WTicta 

Co 0 3 9] mm^mM\.^(omm-mmm 

So 1^11 oti. :^mmBmti^m^t^^^--j hy-^<D 

ti. tmcommmm? o o i tcjcoTSJ^^nrv^So 
^Lx. mimmi op i teic^ i ^^rcm&^^<Do.- 

"^(DUl/klzL—^l 0 0 0^g^fc1:rSCi:*^T#SJ:3 
30 tc^-^Tl/^So rt— ifOnvif 7 00 OfflSKT* 

:$?7 0 0 0:6^3M{iL/c/^^'y h^fflft^t-'y h 
'7-^±tO&/-Ktcfitg*rSjlfiSM7 0 0 1 i:im:!K 

>if OL— ^ 7 0 0 0tclittSJ;-9^c'rSo 

[0 0 4 0] mmm:m<Dwm^r:>\^^xfmt^a 

0 1 Hi. 3iMgH7 0 0 1 <0rtgPO«^^^-rrP^y 

^i§iT'£)So ^1 H^^-rj:^tc. mm^W-ioowc 

7024a. 7024b. 7024c. 702 

40 Adift^m-^nx^^K^. amsg7oo nicne»c>ii 

{m^^ir\^xmi^t^{mmmmmh(omx^^^-j 

g7 0 0 1 ±m(o^mmmi 02 a a-7 0 2 4 

dtC^^jSL/c^>i$?:7x-Xa3 7 0 2 3 a — 7 0 2 3 d 

0 2 1-^. f^^-J bco$Ei^oS(o$E^^<?Dif$s^i2it-r 
S^Eil^TfeT— ':/;l'7 0 2 2 i:. T^^-r^^y/^^-y htcj* 
-rs5[iil^?T^/ci6(OT<>7^'r:/t^^y hy-^m^nmm 

(Act iveNet work Execution Environment) 7 0 1 0 i: 

50 ;b^iatte>nTv^So T^T'^y^^^yhy-^mn 
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0 1 Oti. rtgP^C. T'^'T^yz^-Y i-Tu^^'y 
A) ^*tTt-^/c:i6cOn-F*f7a5 7 0 11^. Z^x 
>r::/r3-K;&te^LT43</'ca6oii-F?etSgP7 o i 2 

[0 0 4 1] CCT. ^1 1 ^#FaL:^/)^^. COilfi 

0 0 1 (Dmmmm^^wm-t^. Kst-^ftno 
jifi^®:^)^&afif«7 0 2 4 ^^i\\.Xf^^-J vt^mm 

-r^t. -rv^I/x— XSP7 0 2 3 dfjI^^O^^^y 10 

^mi^ummm^i o 2 1 tciSTo SiMsaiias7 0 2 1 

fiTC (source) TV\y:^h^9t (destination) TKU- 
feiM5t'r->^;l/IE1ta5 7 0 2 2 tclBit;^ nTl^^GiMft 

[0 0 4 2] ^^^y h^<Dli:imt±^< 23lDtC^Ht^ 

. TfeS^^JJlti. !liE3MJailSI5 7 0 2 Ui. ^O/^y-y V 

^f-^y"^--/ hU—^m^rMmi 0 1 Otc*5i/^Tti. r3 
-FlfetT?a5 7 0 1 1 ti^t(D^<^y h^^ttSit). ^O/^ 

1igl57 0 1 2 5(j^Bi^^tBLT^tT-r^o :3-K^ 

gi57 0 2 1 icmLrmo^mm^micMLrmmr^ct 
KiM-r^-^^^coT^^ig^tcfi. $EiMso.aa5 7 0 2 1 

ti. S^^$E^^tC^ilSL/c-<>'^:7x-XgP (7 0 2 
3 a-»^7 0 2 3 5-^7 0 2 3 cJS:^) tcMb> 

xaPA^ilMSI (7 024 a-*^7024 b-^7 0 

So 

[0 0 4 3] tlCT*(i:5iMI®7 0 2 4 d^^M.T 

[0 0 4 4] mm^wi 0 0 1 ^miMW^^i 

[0 0 4 5] *^fiSJg?J/)^»B^i:TS:7U-Ay-<:7T' 



Jttrffi 2003-283554 
So CCT\ ±TO (^•a-~/^;l/) IPTKl^Xcom^ 
s-efet)^5fel PTKl^XA'«dT*^S<}:-5^>'^^^y 

(s. d) tmt>-t^(Dt'r^o ^fc. mmmm(DT^ 

[0 0 4 6] *:7U— A7-^T'Ci. ±fS#^iOrL— 

A= {(s, d)e[(Oxi)U(IxO)] Is^ 
d} 

m^TS^T(DI PT Fl^X^O^/^-rn:6^^^M^S7t:^/c^i 
Fl^X^rScfc^^/^^'y htc^fLTT^-feX 

[0 0 4 7] SIS^— trtcM-rSnffltOZ^-r^ 

vif^$>^mmmm (/-f) tctssa^nTi^s^^. i 

#B (i<i<n) (DT^^^r^-Yi^. m^c 

(1) (C (i) CA) tcS-rS/^^-y h^^i'T'^i' 

T. r^7-^-:r^^yh'y-^mnmmit. c (o uc 

(2) U Uc (n) ^Sftlife^O^^T'fe 

^/^^-jh (s. d) tcJ:oTeB!l^ns*>OT'feO> 
c:(DJ:3:&/^>>-*y F^ TTi^T^-f -^/^^'y FJ ^^q^^'d 

[0048]gll2ti. lail (C^>L/'cKaM5t7"-:^;l/ 

iBita57 0 2 2^cn^m^nr^^^^.m9t'r-^j\y<D—m 

[0 0 4 9] ^ 1 2tc^-rc}:^tC. feiM^-r— 
i57-rr (Type) ^^5tZFlxX (Destination) ^jMfi 
^TFl^X (Source) hn^9t (Send to) O&JSB^ 
#A.TV>So ^^ycom^it. y/UC^niVF CO 
^?-r7'^St5t"t>Or*S!5> rr<5^x^:^ (Active) J 
feSVMi rji^ (Regular) J <DV>-rnA^Offl^i:So 
^^feZFUX^'ctt/iMffTcr FUXOIggti. 
O/^-^^y Fcor^^t 1 PT FUX^'cfct/aMmjt;! PTFU 

xtc^n^'tij^iS-rs^i^oTfeSo te^5tcDigetiti. 

^B^fer F l/X iriMfiTcT F Ix'XOm^^-it^^T -y ^ L/c: 

mm&^^^m^m9t(DmmMm(D i pt fux^^^t 
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[0 0 5 0] r7^7^^:/j T-fe^xvh 

[0 0 5 1 ] 1^ 1 2 tC^-rfsjM^t-r— ://l/OMtC^5V^ 

hO. 5S5fe7'FUX:6^ ri. 2. 3. 4J T*feO. iMft 
^7KUX:^^ TAny ({pJ*e^J;V^) J T'»0> feiMft 

ri. 2. 3. 4 J tcT'v^-r^^^tcti. is^-r 
rr^-r^i-y^j T^$,t). %^rFux/j^ ri o. 5 

0. 0. OJ T$>0. mmTzTVlyXf)^ r 1 I. 12. 20 
13. 1 4J TfetJ. rT^7"Y:/=i-FBj 
^^-pTI/^^o cnti:. ^^TFUXiiaMfiTtiTFUX 

^yt)"^ rz^-r^yj Tfet). ^^ZF^X;b^ TAny- 

(^5J'e^>J:v^) J Tho. mmftyv\y:^ff^ ri 57. 

2. 3. OJ T'^D. rz^'r-i':/r3-FCj 
i:^oTV^So cnt±. fS^feTFUX^^V^^^^^ZFl- 5(> 
XT^^oTt. iMfiTtrFUX;??^ ri 5 7. 2. 3. 

[0 0 5 2] i5:4o> |g| 1 2 tC^T i: ^ tC, lEjM^fex— :/ 

[0 0 5 3] u±Mm\^rcmmmm(Dm^^^^ib^o 
m \ nc^u/c'Y:y^7x-~xr5l5fi. iffifiiastc^^t^ 

TcZ F UX ^ fc Ci^LJ^t r F L-X ^ ^ n e M7a O Z F 
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•r^te3M$tZ FlxXOlS^^jb^ag^n/c^JM5t-r-:/ 

^3m\.rc^m^^'ry F^BufB^>^>^x-Xgp*>e,iffi 
^n/tSt-> ^i^gfi/^^^y htOillftftTFl/X^/cti: 

FUXte:S-::>^^TMfBf5iM5t'r-y;l/^#PSL> 
HtSfEt£3^ifex-:/;uti:Si$S{i/^>>->y foz fuxco/^ 
is^-vtcjxfis-r^iitoai^fer Fuxtots^BA^^si^nTi^ 

/ctS^i::tiai^S{i>'^y^y F^m^^O^iS^tTFUXtc 
fq]ttTiMffi-r§,^ ^tc^KlEjMJfeT FPXtcJJiSLfc^ 

v^5? :7 X -xgptcifi-r ^ t tc. uuHB^teaM^tf^— 
SK§fi/^^^y F^DTFUXiT)/^^—^^^^/;^;^^:/^ 

To 

[00 5 4] :^^tC. *:|feSfifl5MtC^tt^r^'r-i'7'3 — 

F<D-fe4^rLUx-<jcgi-r§^7^;UE:ov>Tm0^-rso ^ 

[0 0 5 5] m 1 3ti. ±lBO-tr:^zi U ^ -t-r/L/^^ 

3tC^'l^T. 0 5 Ui:i-^f AcDOL— ^f«S*S 

S. 7 0 6 1 \i.WM.m (Certification Authority ) ^ 

^n^^i^T^-tr^oT^ia^/^b. ^^vnilSP (Intern 
et Service Provider, >r>^$?-^^*y FJg)f^-9--lf Xfii« 

;fo. HI 1 3 (C^-rfi^ijT'ti. rL-lfjffi5fe^M7 0 5 1 O I 
PTFUXti ri. 2. 3. 4J T'feSo l^TT^i. :x 
-ifA:6\ Z^-r^yr]-FA^jil{i^g7 0 0 UC^ 

■r-Yy=J-FA^a--if A;b'«X¥b> ^n^iim^B7 
0 0 1 \cWtmct^^o:>x^Si\^^a 

[0 0 5 6] S-f (1) T'^-rJ:-5Jc:. OL— ifA(OiL— 

*!fi^S*^e7 0 5 Ui. ;i^PJSt5^fflt/-TllO-<Tt-^ 

t)*s^Bagii:$Kmit^^^^-r^o ^UT (2) T'^r 

J: ate. :x-1fdS*^B7 0 5 Hi. ±T*^^^ti^c^ 

rjiii^i^jiE^^B7 0 6 ucsii-r^o ccoi:^. mm 

7 0 6 Hi. rL— <fSS5l^^B7 0 5 1 I P T F 
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^ffiS^SH? 0 5 ItDI PTFl/X ri. 2. 3. 4 J 
;^^ig|E^^«7 0 6 1 tciEit^n^o 
CO 0 5 7] (3) T'^t-J;9tc. y'filgTl^^ll 
7 0 5 Hi. ±.'x:^igi^nmm^^m\^^xT^'r^':r 

n-KAtcm^SS-rSMS^tT^o -^LT (4) X^TTs 
r^^\C^ :i-if«»S[l7 0 5 Hi. *gffiaiT*S«^ 

n^c7^x^:/:3-KA^ii{fS@7 0 0 uc^g-rs 

[0 0 5 8] cn^§ttT}l<i^g7 0 0 Hi. (5) 

if Aoa^iiBBS^igiiE^^H7 0 6 1 t-^^mnt^o 
coa^iEB^gicti. ^— y^A^fagij-rsti^i:. 

I PTFb'X ri. 2. 3. 4J ±fO (2) JC^ol.^ 

(6) T^-ri;5tc. 3ifi^H7oo ±ie<DS? 

^0^»*^P>B?(9aLfcaL--if A(Oi;^IIBg!^fHl/^r. ±.<o 
(4) tc^sv^T^g^nfciZ^T^-i' >^n-FAOa^^ 

(i. 7 0 0 Ui. T<>'r^:/n--FA^r<>-r 

[0 0 5 9] rj:t5^ (1) ^3<tt>* (2) OjaHA^T 

t:)nT-B.:x-if At01>r^1^;6^|^.sI^3^B7 0 6 Ucg 

ii^^n^i:. :i--»fc*^M7 0 5 1 {t^<o{i>mm^cn 
^mm^mi o o i \z^m-t^^ht.'^mx^^o 

[0 0 6 0] 0^*9. ilfi^B7 0 0 1 ti^HgP mTT^ 

C iO<^tiE:^)'«^% L /cif^tc i a y A tc^^iSr ^ 
r FUXO>'^^->i:^f^ya<>-^A(Olf$Bi:^BufBlE 

t>rj:\,>X'?\C^^^(OXh^o 

[0 0 6 1] :&4b\ ±,xmm\^rcmmmm^<oT^'r^ 

>^:3-FOg®<0#)iH*^W^JtcafiE-r^rc46tcti, 

2;;?.;6^Hifli^;S:^o ^lOlSji^LT. :n.-^^ifE(Dm 

fs^li (/-F) tc7^x^:/:3-F^i^isrntfSi/^ 
- F) \iLT^v-^y^-v^m.U'tn{^^\^^t^ti^t^t^^ 

/ci60-r^ U<> FU+>— tfX;6^iSifit^nTl>^o 3520 

Pii^»M :7 ^ i^xmn u T 1/ ^ ^ }6\ {iioigiE^ 

[0 0 6 2] ?iiOB??iCD/c:4i)0$lJfflltCOU^Tltt 
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0^*r^o fe^sfi^e (y-F) tc^ov^r. nffloz^ 

7^^yn-F;0^a^^nT:fot?. i#@(l^i^n) 
(l<J<n) <Dy^7"-<:/:3-F*^ 

n^^c (i) (c (i) cA) ii^^c (j) (c 

(j) CA) tcS-r^/^^-y Ftc:«-rs^>OTfe^^^ 

s^nri/^s^^. ai^ (c (i) oc (j) ) A^'^ffl 

^Tti^V^cfc^^S: i ^focfct/j (Om^"^^ (ffiL i j ) 

#gor^-r^':/3-Ftct, J SecDZ^-r^yrj-F 

CiDJ:^^^®ti. ::5^i0 2®t)^Oi/-:^U:tOl/^-rnAHi: 

[0 0 6 3] m 1 03^/tOfi¥«-50S^*^U^tA. F 
(s, d) tii^LT. 

(seo (k) AdeO (1) ) A (k=5fcl) 

(s. d) ec (i) Oc (j) 

h^^il^lC^-r^tOT'fe^o (IL. O (k) ^^XS 
O (1) ti. -^eti-^n^x-lf k*5j:tf nc<J:oT0T^^ 
20 I PZFb'XO^^Tfe^o o^O. fe^/^'^^y h 
tcHLT. }M{S7t;C):x-^fffliDZ^-r^y^=]~F^^^ 

(s, d) mmi.rcm'^x^^. ^(o^orj:^^\z 

ti. ^B5tC):i-'»fC>r^-r^>^ri-F^fl5feWtc®ffi-r 

[0 0 6 4] o^D. ^?M5t-7"— r;i/tcgii^nTt^^ 

r FUX;b^{5j-t:^^ci:(/>^^nTi/>;S>^ 1 (Ox>' h U- 
30 ^^7'FUX(D^*'«}g^^nTV>T5Mfi7cTFl^X 

ti'^i^x^^i^t^Hx^^^mzcDJLyhv-tti^n^n 

(Dxvh U — h<0H>3Jc s^^v^Lfc^.^tcti. ^ 1 cox 
2 0x>'hU-co/^t$?->tc Jtf iS-r ^ y n ^'-^ A ^iEKj 
[0 0 6 5] C(7)ct-9tC. iJifiTCCO:^— TiOT^-T^^:/ 

40 Do S (^i![SDo S, Distributed Denial of Servic 

Si:^^o 't(OXr>\z'^^^t\cX-oX. iS2*coa.-+P 

11^ ^ ^ ^ Rlftei4:6^ ^ ;5 coco T -r Y y n - F cfc t) 

[0 0 6 6] m2<0^/icoS?mc05>-:^U:tti:. feS>'^>^ 
h (s. d) tcMLT®ffl^n^-^#2-3t^±(OT^ 
T- ^ T'a - F :^^f5l-OaL^^f J: o Tggi^ nr I ^ ^ if 
^te:|3^-r^€>cOT'^^o iiOck ^ ^Sr^^^tcti, nS^T^ 

r :/=3- FC03 ■^co^*>*< gg^nfct>co/)^ 
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m(o^<D^ K> i^m^mK^m-^^^xo ic-r^ c htm 

[00 6 7] c:n^'C^*ca?-</£:<i:5^T<>'r^y 

i n u x±CD J a V a (ggjffi^) ^SS^^v^V (J V 
M) ^rai/^TT^x^rv^^r^y h OMSH^tT ^ Mlfi^^ /O 

[0 0 6 8] m \ A\C7^^mX-\it. HfflC) I PXi5?'y 
^SaSi (process) O-gPi: LTlft^LTO^So cntc 

i:'ptcLTV^;g>o ^fc. cn^c#v\ (kerne 
I) rtOI PX^^y^ti^^i::^^/cA6. :^-;t^;Utc*5 

/^^^y h:0^^-f'>^-^U 1 i b p c a p^MLT J a v a 

[0 0 6 9] 9m(o—mti.rm?k\^tcMm(o\ px^j? 
x*<Dm^(o'^mc^ y ^-r § i p r k ux (^5t i p r 

;^^t-^/^>>-'y ^fTll^±t:eK)^n^r^ 
•r^yn-Ftc^bTit^n^o ":^> T^'r^'^f^'r 
-y HXil'OiiB'Si'iD/^^ y h(i. ^^;I/tc:fott^ I PX 

:6^^^Tt)n^c T^-r>r y^/^'^-'y hT-^nM^/^-y -y hT^ 

CCDffifiS[l;?)>^aMl±i^n^*r'^TtO/^>:r'y h 
(i. I i b n e t ^jibT3MtB^tiSo C -5 

i^^ti/caMfiTcTFUXti, 7C>^^aDJg{f7cT F UXO^ 

[0 0 7 0] ^/-c. J^^^O J a V a (^^K<1) (D k P 

I (y:/U^-->3>:/o^'^A-i'>'^>'a:-X) 

^ Tjava. security J ^JI3l/^^ C ^tc<fc-^T-tr4^iL U x 

^(Dmw^kp Wit. '^^rL^)7-^=e^)\y^^mt^ 
mm<ofc^(o^^}i LTti rx. 5 0 9 j fiE0^§jB^^& 

I PTFUX^ rx. 5 0 9J (OmfA^ (DN. distin 
gulshed name) (D—m^i^ib^^hlzXO. **fi£f^^ 

[0 0 7 1] Md^T^t^<, ±tB-f 
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tg±Tt7)7^-r'r F^0^16h^Offlao^tT^> 
«ftg!^n/c:/^y*y h(D:t'«*y F »7-^-NCD3im:^i:OS«a 

[0 0 7 2] ±aiL/c^=i ^tTzi-^yn A 

0. iffifiSli^Jcjsas^nfccpu (**i!iHii^il) is^ 

C OlBSJ«i*:^J^ B 13 > 3. - ^ :/a A ^ru^fX o 
T. ljtKI»®fe§l/>(i-tf--tfX^i^i--;I/}lfitiFtDrc^ 

ROM. CD-ROM^ODra5«{*. nVlf^ — :?>'X 
n§>'^- F*rV X ^ ^tDnBISSH^O C ^ ^ 

■^^ ^-l^T V F iQ:^ ri V If v'XT^AF^gasoSKfg 
(RAM) (DX'ylz,. -immfu^"^ 

[0 0 7 3] ^;^c. ±gByny^Ati. ZKO-fu^^K 
^IBtgSa^tctgJftL/cn^troL-^S/XT^A/)^^. 

-y h^o:^^y mmm) "^mtm^^cDmmm 

[0 0 7 4] ^fc. iteyn^'^Ati:. t9a?L/c<a^cO 

-'^^mMt^rci^o:>^a:>x^-DX^^^^. ^etc. fy 

aL/ciSB6^3>trzi.-^>^xxAjcro-SBS^^nTi/^ 

^M^^^^z-ryb (M^^T^o^'^A) T^oT^Mi.^ 
[0 0 7 5] ^fc. Ti5SC>'y--hiiDft^iaA^^±SitOiffi 
fie@^0-r-^<DilHi(i. 7^7^^ >^^x«y h 7-^0 
<^ffltc|5g^-r^tOT*«^<. ffigiOii«:/nFr3;l/CD 

[0 0 7 6] ^/-c. hmmmsmm^mi^tv- h ^ 

I Pr Fl^X^^JtoffTtOilff y-FT^oT€)fiV^o 
[0 0 7 7] (lI®^#PSLTilOf80^O^SteJgS8 
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[0 0 7 8] 

J: o Tl* W L tcikrn^^ h ^ k -y ^ <D^^ y + ^ 

-fe D D o S iJciPcDam/ -y h ^iK*-r ^ C i: T?^- -y 
Co 0 7 9] Sfc. :|^ y hy-i'0$^)im»S{±D D o 

^-if oii^ h ^ k >y <^ (o&mwm(omm^m\^r s c 20 

i:AWteii:^So ^>eoT. DD o S iSt^(Djlft/^'y -y h 
*»jRL*jb^e.t. ?iSiil!g#<Dj§^-r«-9— ex^KU>' 
-«rS^*L,r. ^-y Kr7-^±©IE^fiJffl#Oh^t:-y 

[0 0 8 0] mtc^ m?il£-^>i'—^-^-y b<D^vlc, ^ 

m^^mm<omm^m^xi^i3:\^^^yh'7—'yx^^x 

:^mm^mmT^ctic^-Dx^mKti-r^m^^ 

nxi^^:^-y hu-^m<oictmicj^^x^mmc mmm 
[ia 1 ] ^^imyico-mmcomm^mmx^^ >y h y 

[ia 3 ] i^nmmmic ^ ^iEm^w<Dm7js.<Dmx& 

5o 40 

[04] |Bl5lfiSOJK»lfcJ:5^iEh7t:-yi'tgtB^ff 

[iij5] mmm<oi^mtcjz^y-hmm2 0 0 1 at; 

ilffi»B2 0 0 2 — 20 0 6A<«;^5^«*iJffll*r^U-p 

[me] mmM(ommicj;:^y^?i^ 2021 ic^stt 
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[0 7] m^m(ommic ^ h 2 0 0 1 oia 

So 

[0 8] fRlJISSiDfg.^tC ct S jlfi^S 2 0 0 2. 2 0 
0 3OS^^':t^^^§{fi^<0»l{t^^-r:7a--5^-v-h't? 

[0 9] 111*11® JB!® t i s y-h ^a2 0 o i&tf 

iifiSBZ 0 0 2~2 0 0 6(D^IEh'^^yi/mtm<D 

mf^^-rya-=f-^-hX'$,^o 
mi 01 mnm<Dmm^mnx-^ ^y^T'-f-r^-y 

[011] mmmo:>Bm^mnx^^T'i'r-^y^'y 

[HI 2] mmmmm^mnT^^y^v-'^y^-^-j 
h y - ^ J: s fejM^fer- - :/;i/gBisa mm ^ nr i/ ^ s 

[0 13] |Bl*S6(Dff$^;^^fTT'#ST^7"-<':/:t^^;/ 

[0 14] (pI^j5teiDmi^^fTT^^;g.T^7^^r^^'y 
hy-^cDffl#SM^L i nux±cDJ ava (SiilS 
<f) (J VM) ;SrJTH/^T7'^7^>r:7^/^^^y h 

[??^<^IttH^] 
2 0 0 0 '— 

2 0 0 1 -^-hmm 

2002 — 200 6- •ilftS^ 

2007-20 1 o-n&m^m 

2 0 2 1 -•:7^7l/^ 

2 0 2 2 - IE^i^^X 
2 0 2 3 -iEgil^ii- 
2 0 2 4 •^jE^'^X 
2 0 2 5 -^-^IE4^ii.- 
2 0 2 6- -g^<^7^x 
2 0 2 7 --glJ^^ii- 

7 0 0 0 - rL— tf^onvtroL — ^5? 
7 0 0 1 -iifi^e 

7 0 1 o -T^y^^y^^y h'y-^mjmm 

7 0 11 -n-K^ltTgp 
7 0 1 2- -:3-HfB1Sgl5 

7 02 i-nmmm^^ 

7 0 2 2 • ■«55MitT— :/;naita5 

7 0 2 3 a> 7 0 2 3 b •M'>'^:7x— XgP 
7024a. 7024 b'-mmm 
7 0 5 1 -^-IfftSg^gB 

7 0 6 1 -mstmmm 
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Z007 



2009 



DDoS Zk^m 



2008 



DDoS JkVn 



2010 



DDoSftM 




LAN 







1 


(Src»l72.1E.10.0/24) 


2 


{T0S<4)xai> 



2000 



[02] 



17] 











t 


{Ost-192. 188. 1. 1/32. Prolocol«TCP. Port^^SO) 


SOOKbps 




2 


(DsM92. 168. 1. 2/32. Prolocol«UDP> 


SDOKbpB 




3 


(Dst»192. 168. 1.0/24} 


IHbps 


20 f» 



%«$fi!h9tv'iS'ttttl S3Qtl 



S3012 



53013 



S30M 







1 




2 


T2 Kbps Ja±0 ICMP/Eeho Reply /t<ry S2 »U±itfil3lfgffnTt^'6 


3 


rs Kbps ja±<D75yjtvh/t{ry hjjf S3 i^u±ai»a£<B^EnTu« 
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S3007 
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[13 5] 



[138] 



r?n?i 



A* 






Ba«d 1 












1 






1 






1 











S3022 



'S3023 



-S3024 



[13 9] 



[Ell 0] 

















1 






1 











_S303I 
^032 
S3033 




[^11] 



7024d 



7010 



<AcrtA/o Natvwork Exeouilon Environment) 701 2 



7021 



7011 



; 
I 

X 



7001 



_ 7022 

/7023a 



7023d' 



^ — I -jy^yi-^Lm i - — 



7023b 



7023O 



7024a 



7024b 



^70240 
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[mi 2] 



V 



(Tyoe) 


(Destination) 


(Source) 


Send to) 


(Active) 




Any 


P^7x-r:7D-KA 




10.60.0.0 


11.12.13.14 




7o^^y 


Any 


1 57.2.3.0 




(Regular) 


1.2-0.0 


N/A 


29.15.20.1 




11.20.0.0 


N/A 


109.1.1.10 




199.1.1 .0 


N/A 


120.0.0.1 











1 3] 



(2) i^eatitstm 



^2 



(Csemflcatfon Authorfty) 



(4> afSSHtCPC? 

IS 



7051 :3-tr!a5RSS (a- 
IP 12.3.4 



■1fA> 



(5) e^ ESBSSTO 



n-tTA 

I P : 1.2.3.4 



mm 



"po'f'iyu—'^pK 

(I P1.2.3.4a^$t 



J 



7001 : 



1 4] 



Rbpcap 



%S (process) 
ii— S it (kernel} 



^frSSW (Execution Environmenl) 



1 t — — : 

I IP 




1 !■ JVM i 




JM s 


1 JNI 







CacUve packets') 



} 



IP 



(packet capture) ^ 



j (ctipv of Incomino " 
packets) 



03 



]}"■ 



disable rouUno 
(IpJorward-^O) 



(date link) 



n 



(inoomino packets) 



(outooino packets) 
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